Extracted

• • Target

    cc82bc2cc6d09e19ed88c7ff86d952bbe97e12d73e17f9377e16bfeef780662e.exe

  • Size

    1.0MB

  • MD5

    a7b07a73cc640c387c3dbfbf5104a5bc

  • SHA1

    fae32af8e7eaec57aca890881ff043772ca28bfd

  • SHA256

    cc82bc2cc6d09e19ed88c7ff86d952bbe97e12d73e17f9377e16bfeef780662e

  • SHA512

    b87cae08eb793e4ada56fd27b1d263ca1eea2f3bc57c824f9bc66a3d2135f777c7ace81f84b105e204e2a778fd84dd2f4e88f59086b6b112b2f098f7a6e56f30

  • SSDEEP

    24576:stb20pkaCqT5TBWgNQ7arslkvopEkQBX6AK:VVg5tQ7arsWvXp5K

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2